CVE-2024-10718
Cookie without Secure attribute in phpipam/phpipam
- State
- Published
- Severity
- 5.3 Medium
- Published
- Mar 20, 2025
- Updated
- Mar 20, 2025
- Reserved
- Nov 1, 2024
Description
In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookies in plaintext over an HTTP session, potentially exposing sensitive information. The issue is fixed in version 1.7.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | @huntr_ai |
Weaknesses
- CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected Products
| Product | Versions |
|---|---|
phpipam/phpipamphpipam |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.